Port 3101: BlackBerry SRP — The port that ran enterprise email and never registered

What Range This Port Belongs To

Port 3101 falls in the registered port range (1024–49151). These ports sit between the well-known ports (0–1023), which are reserved for core Internet protocols and require IANA assignment, and the ephemeral ports (49152–65535), which are used temporarily by client applications.

Registered ports are meant to be formally assigned by IANA to specific services. You apply, IANA reviews, you get your port. That's the system.

Port 3101 has no such assignment.¹ IANA's registry lists it as unassigned. But that didn't stop someone from using it anyway.

The Unofficial Tenant: BlackBerry SRP

For well over a decade, port 3101 was the home of BlackBerry's Server Routing Protocol (SRP) — the proprietary TCP connection between a BlackBerry Enterprise Server (BES) and BlackBerry's global routing infrastructure at srp.blackberry.net.²

SRP was the nervous system of corporate BlackBerry deployments. Every time a BlackBerry device received an email, a PIN message, a calendar invite, or a security policy update from an IT department, that data traveled through an SRP connection. The BlackBerry Enterprise Server would maintain a persistent TCP session to port 3101 on BlackBerry's routers, and messages flowed both ways through it.³

Corporate IT administrators knew this port by heart. Firewall rules across thousands of enterprises had port 3101 explicitly opened. BlackBerry's own documentation listed it. And yet, as the Wireshark project noted when documenting the protocol, BlackBerry never formally registered it with IANA.²

This is more common than it sounds. A company builds a protocol, deploys it widely, and by the time anyone thinks about registration, the port is already baked into a decade of firewall configs. The informal becomes the standard.

BlackBerry's enterprise server business has significantly declined since its peak in the early 2010s. Port 3101 SRP connections are much rarer now. But if you work with legacy BlackBerry infrastructure — or you're auditing an old corporate network — this port may still appear.

Checking What's Listening

To see if anything is using port 3101 on your machine:

macOS / Linux:

# Show processes listening on port 3101
lsof -i :3101

# Or with ss (Linux)
ss -tlnp sport = :3101

Windows:

# Show active connections on port 3101
netstat -ano | findstr :3101

If you see traffic on port 3101 that you don't recognize, and you're not running BlackBerry infrastructure, it's worth investigating. Unfamiliar listeners on any port can indicate unexpected software or, in adversarial contexts, something that shouldn't be there.

Why Unassigned Ports Matter

The port numbering system works because most software follows the convention: register your port, use your port, tell everyone about it. When software squats on an unregistered port, it creates friction — firewall rules are harder to write, network documentation is incomplete, and security teams have to reverse-engineer what a connection actually is.

Port 3101 got lucky. BlackBerry was large enough and well-documented enough that the squatting was widely understood. For every port like 3101, there are others occupied by software that nobody documents, running services nobody audited, doing things nobody intended.

That's why port inventories matter. An unassigned port on your network isn't inherently suspicious — but it's always worth knowing what's there.